Email Notification - Office 365

[AHmed Abdulla]

Good Afternoon Colleagues

I hope you are doing well . One of our customers has Office365 and we need to configure Notifications by email . We have tried many configuration for office 365 but all failed.

Can you share Office365 configuration for Kaspersky notifications for the below:

 

• SMTP Servers:
• SMTP Server port:
• specify TLS settings for SMTP server:

 

Thx in advance.

Best Regards

 

[KarDip]

 

Hello @AHmed Abdulla

To configure email notifications for Kaspersky through Office 365, here are the necessary settings you need:

SMTP Server Configuration for Office 365:

1. SMTP Server:

   • Use: smtp.office365.com

2. SMTP Server Port:

   • Use: 587

3. TLS Settings:

   • Enable TLS/STARTTLS: Yes (Make sure TLS encryption is enabled).

4. Authentication:

   • Username: Use the Office 365 email address (e.g., *****@*****.tld)
   • Password: The corresponding password for the email account.

Additional Considerations:

• SPF and DKIM: Ensure that your domain's DNS settings are properly configured with SPF and DKIM records for Office 365. This helps avoid notifications being marked as spam.

• Firewall/Network Settings: Make sure that the firewall or network security settings allow outbound traffic on port 587 to smtp.office365.com.

These settings should work for configuring Kaspersky's email notifications with Office 365. Let me know if you need further assistance with troubleshooting or advanced configurations.

Thank you

[AHmed Abdulla]

Hello @KarDip

Thx for your replay . I have checked with the end-user whom informed me that we need to follow the below document so any application - including Kaspersky- be able to use SMTP protocol to access email data for office 365.

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

 

Kindly check and let me know.

 

Best Regards

[KarDip]

8 hours ago, AHmed Abdulla said:

Hello @KarDip

Thx for your replay . I have checked with the end-user whom informed me that we need to follow the below document so any application - including Kaspersky- be able to use SMTP protocol to access email data for office 365.

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

 

Kindly check and let me know.

 

Best Regards

Hello @AHmed Abdulla

I answered to your topic above that works with Kaspersky.

You have not said if anything in that URL you posted works?

Thank you.

[AHmed Abdulla]

Good Morning @KarDip

Let me clarify . We have tested the configuration you send first for Office365 but it didn't work . 

 

SO the customer check with Microsoft Team and the replied that

we need to follow the below document so any application - including Kaspersky- be able to use SMTP protocol to access email data for office 365.

https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

Thx for trying to help and kindly let me know if you have further thoughts to solve this issue.

Best Regards

[KarDip]

Hello  @AHmed Abdalla 

Okay thank you for letting me know my first response did not work.

It's not as easy as microsoft writes, as they are blocking anything we try with Authentication.

Using OAuth2 to authenticate IMAP, POP, or SMTP connections for Office 365 can run into challenges when antivirus solutions like Kaspersky are involved. This could be related to SSL/TLS interception, port blocking, or traffic scanning.

Okay so let’s walk through some potential solutions for this issue:

1. Whitelist Office 365 Services in Kaspersky

• Step: Go to Kaspersky’s settings and add exceptions for Microsoft Office 365 endpoints.
• How:
  • Add the following domains:
    • outlook.office365.com
    • smtp.office365.com
  • Add exceptions for ports used by IMAP (993), SMTP (587/465), and POP3 (995).

2. Disable SSL/TLS Inspection in Kaspersky

• Kaspersky products sometimes perform SSL/TLS inspection, which can interfere with OAuth2 authentication.
• How:
  • Go to Settings > Network Settings > Encrypted connections scanning and disable encrypted traffic inspection or add an exclusion for the Office 365 servers.

3. Allow OAuth2 Applications in Azure Portal

• Verify that OAuth2 access is correctly configured for IMAP/POP/SMTP within your Azure tenant.
• Steps:
  1. Go to Azure Portal > Azure Active Directory > App Registrations.
  2. Ensure that your application (or the registered OAuth app) has appropriate permissions:
     • IMAP.AccessAsUser.All
     • SMTP.Send
     • POP.AccessAsUser.All
  3. In Exchange Admin Center (EAC), confirm that IMAP/POP is enabled if those services are used.

4. Bypass Proxy or VPN Settings for Office 365 Services

• If Kaspersky VPN or proxies are enabled, they might disrupt OAuth2 flows or redirection URLs.
• Solution: Create split tunneling rules or bypass policies for Office 365 endpoints.

5. Test OAuth2 Authentication Without Kaspersky

• Temporarily disable Kaspersky on the test machine and try OAuth authentication with IMAP, POP, or SMTP. If it works:
  • It confirms that Kaspersky is causing interference.
  • Use the above whitelisting methods to allow the traffic.

6. Verify Modern Authentication Settings in Office 365

• Ensure that Basic Authentication is disabled and Modern Authentication (OAuth2) is fully enabled for the account.
  • Go to Microsoft 365 Admin Center > Settings > Org Settings > Modern Authentication.

Let me know if you need further details on any of the steps!

Thank you.

Edited October 28, 2024 by KarDip
elements console

[AHmed Abdulla]

Good Morning @KarDip

Thanks so much for your detailed replay . I just have the below clarifications:

• Regarding first step "Whitelist Office 365 Services in Kaspersky", It should be achieved using Web control . Is that true ?
• Regarding forth step , " Bypass Proxy or VPN Settings for Office 365 Services" , I think you mean disable Kaspersky secure VPN connection . Is that true ?
• For Proxy , How to confirm that no proxy is used ?

 

Thx in advance.

 

Best Regards

 

 

[KarDip]

Hello @AHmed Abdulla

1. Whitelisting Office 365 Services in Kaspersky – Using Web Control

Yes, web control can help, but it depends on your Kaspersky product.

Here’s how you can confirm and fine-tune it:

• For Kaspersky Endpoint Security Cloud or similar products:
  • Navigate to Security Profiles > Web Control.
  • Under Categories or URLs, create exceptions for Office 365 services:
    • outlook.office365.com
    • smtp.office365.com
  • Apply the changes to the relevant security profile.

However, if your issue involves network or SSL scanning, you might also need to:

• Go to: Settings > Network Settings > Encrypted Connections.
• Disable scanning for those URLs or services.

Why: OAuth uses tokens, and blocking or scanning redirects through Web Control might break the flow. Whitelisting here ensures that Kaspersky won’t interfere with web-based or cloud traffic during the authentication handshake.

---

2. Bypassing Proxy or VPN Settings – Disabling Kaspersky Secure VPN

Yes, you are right! Disabling Kaspersky Secure VPN (or using split tunneling) is necessary for troubleshooting.

• How:
  • Go to Kaspersky VPN > Settings > Disable VPN or create a split-tunnel rule.
  • Make sure the following Office 365 endpoints are excluded if VPN is needed:
    • outlook.office365.com
    • smtp.office365.com
    • login.microsoftonline.com (for OAuth tokens)

---

3. Confirming No Proxy is Used

To confirm that no system-level proxy is interfering with traffic, follow these steps:

Windows:

1. Control Panel > Internet Options > Connections Tab > LAN Settings

   • Ensure “Use a proxy server for your LAN” is unchecked.

2. Command Prompt:

   • Run the following command:
     Copy code

     netsh winhttp show proxy
   • Output should show “Direct access (no proxy server)”.

Microsoft Edge/Chrome:

• Type edge://net-internals/#proxy or chrome://net-internals/#proxy into the browser.
  • This page will show if a proxy is being used.

Kaspersky Settings:

• Go to Settings > Network Settings and check if there are any proxy servers configured directly within Kaspersky.

---

Let me know if that resolves the issue or if further help is needed!

Also you need to test the information provided otherwise we not going to know what works and what doesn't.

Thank you

Edited October 28, 2024 by KarDip
edit console sources